The Boot Dashboard Docker integration in Spring Tools for Eclipse mistakenly publishes the JDWP and JMX control ports to all host network interfaces instead of restricting them to loopback. This misconfiguration allows any machine that can reach the host over the network to connect to these ports without authentication. The exposed debug and JMX interfaces could permit code execution, unauthorized data retrieval, or other malicious actions against the host or applications running inside containers. The issue is classified as CWE-1327, a matter of improper access control or exposure of management interfaces.

Spring Tools for Eclipse versions 5.2.0 and earlier that include the Boot Dashboard Docker integration are affected. All installations that enable this integration, regardless of the containers they launch, are vulnerable. The problem is not limited by container configuration; it arises from the way the integration binds the ports on the host.

The CVSS score of 8 indicates high severity. The EPSS value of less than 1% suggests that exploitation is currently uncommon, but the vulnerability does not appear in the CISA KEV catalog. The likely attack vector is simple network reach to the host; since the JDWP (commonly TCP 8000) and JMX (commonly TCP 7199) ports are bound to 0.0.0.0, attackers do not need authentication. Based on the description, it is inferred that any host on the same network can potentially establish a session, and with the proper debugger or JMX client, gain control over the running application or the host system.